Skip to content

Commonplace

by trycommonplace.com · remote · no sign-in to list tools · v1.0.0 · published by com.trycommonplace

Use when selling a big item: fitness gear, hot tubs, furniture, appliances. Pickup handled.

Deletes · 5Final · 1Changes · 7

23 tools: 5 can delete or cancel things, 1 do something that can't be undone, 7 change things and 10 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http seller https://trycommonplace.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "pricing_quote_payout" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "pricing_quote_payout" says "payout": a word that usually means money moves, which cannot be taken back.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

23 tools

Deletes or cancels 5Claude Code: deny
  • listing_discard_draftDiscard a draft that listing_create saved without photos: it leaves drafts_awaiting_photos, its finish_url no longer opens it, and listing_add_photos can no longer finish it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Discard a draft that listing_create saved without photos: it leaves drafts_awaiting_photos, its finish_url no longer opens it, and listing_add_photos can no longer finish it. Only this account's own connector drafts can be discarded. A draft cannot be edited, so to change one (a new price, say) discard it and create the listing again. Without confirmed: true nothing changes and the draft is described back.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • mark_sold_elsewhereUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…No findings

    Why it is in this group

    • The name "mark_sold_elsewhere" says "mark": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. Call this when the item sells on Facebook Marketplace, Craigslist, OfferUp, or anywhere else. Pass the manage_token that listing_crosslist_draft returned. The listing comes down. No account is required. If it never published, the confirm link stops working.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • seller_remove_listingTake one of the seller's own listings off the marketplace.Reads text others writeNo findings

    Why it is in this group

    • The name "seller_remove_listing" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Take one of the seller's own listings off the marketplace. Refused while an order is active on it - that needs the support team. Requires confirmed: true after the seller agrees to remove that specific item.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: true
  • seller_respond_offerAccept, counter or decline an open offer on one of the seller's own listings.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Accept, counter or decline an open offer on one of the seller's own listings. Amounts are in the same terms as the offer: the buyer-facing price. IMPORTANT consequences: accepting sets the listing's public price to the offer amount, and a counter becomes the listing's new public price for every buyer, not only this one. Requires confirmed: true after the seller agrees.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: false
  • seller_update_listingEdit one of the seller's own listings the way the website's Edit listing does: title, price (price_usd), lowest_acceptable_usd, category, condition, pickup location and photos.Reads text others writeNo findings

    Why it is in this group

    • The name "seller_update_listing" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Edit one of the seller's own listings the way the website's Edit listing does: title, price (price_usd), lowest_acceptable_usd, category, condition, pickup location and photos. Give only what changes. Without confirmed: true nothing changes: the result lists the change and, when the price or category moves, would_result_in (take-home, buyer price, fees). What price_usd and lowest_acceptable_usd mean follows the listing's pricing_basis in seller_list_listings. take_home (every listing made from Sept 4 2026 on): price_usd is what the seller takes home, and our transaction and pickup fees and the delivery are added on top for buyers; lowest_acceptable_usd is the least they take home. asking_price (older listings): price_usd is the asking price before delivery (asking_usd), the take-home is that less our fees, and lowest_acceptable_usd is an asking price too. The platform adds the condition and city to the title, as it does at publish, and rebuilds them when the title, condition or pickup location changes; the preview's public_title is the exact result, and the listing's link does not change. photos is the whole ordered list after the edit, the first being the cover. A reserved or sold listing cannot be edited, and the description is not edited here (support corrects it).

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: true
Can't be undone 1Claude Code: ask
  • pricing_quote_payoutUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…1 finding

    Why it is in this group

    • The name "pricing_quote_payout" says "payout": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "pricing_quote_payout" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "pricing_quote_payout" says "payout": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. The seller's fee math for a category (terms as in the server instructions). Give exactly one of: desired_payout_usd, a take-home, for the buyer price a new listing shows (the transaction and pickup fees and delivery added on top; the seller is paid exactly the take-home); buyer_sees_usd, a price a buyer pays (a listing's price or an offer), for what the seller takes home at it (delivery, then the transaction fee, then the pickup fee come out); or price_usd, an older listing's asking price, for its take-home. pickup_fee_waived is true when, taking fees out of a price, the pickup fee would exceed what is left after the transaction fee. The price the seller asked for on Facebook Marketplace, Craigslist, or OfferUp becomes their take-home on Commonplace. The buyer price includes pickup and delivery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
Changes things 7Claude Code: ask
  • delivery_quote_listingWhether a listing can be delivered to a destination, what delivery adds on top of its buyer_price_usd (0 means it is included), the distance, and the total the buyer pays.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Whether a listing can be delivered to a destination, what delivery adds on top of its buyer_price_usd (0 means it is included), the distance, and the total the buyer pays. When no quote is possible, `unresolved` says which end could not be placed: "origin" means the listing's own location is unknown, so no address the buyer gives will help. `reason` is the platform's own wording, and "calculated manually" in it means no quote yet: whenever there is no automatic quote, whichever end is at fault, the team prices that delivery by hand, and needs_manual_quote is true (ask Commonplace support for one: support_create_ticket where this connection has it, otherwise the support line, (516) 357-5989). A quote gives included_miles (free) and per_mile_usd, the category's rate for miles 101 to 200 and beyond 200. Delivery within 100 miles of the item is already included in its price; beyond that a per-mile fee applies, and most items cannot travel beyond 1,500 miles.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • listing_add_photosAdd photos to a draft that listing_create saved without photos, and publish it.Reads text others writeNo findings

    Why it is in this group

    • The name "listing_add_photos" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add photos to a draft that listing_create saved without photos, and publish it. Only drafts this connection's account created through the connector can be finished here. Requires confirmed: true.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • listing_createUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…Reads text others writeNo findings

    Why it is in this group

    • The name "listing_create" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. Publish a listing for the seller (terms as in the server instructions). Resolve the category with listing_resolve_category first. Condition is required. The category's other questions are optional and can be added after the listing is up. The price the seller asked for on Facebook Marketplace, Craigslist, or OfferUp becomes their take-home on Commonplace. The buyer price includes pickup and delivery. With a photo it publishes live (status live, or in_review outside our categories); with none, a draft is saved and finish_url is where the seller adds photos (or use listing_add_photos). A connection that cannot publish can save a no-account draft with listing_crosslist_draft instead. Drafts never expire or show to buyers; seller_list_listings lists them and listing_discard_draft removes one. Without confirmed: true nothing is saved: the result is a preview of what would be published (public_title, answers as stored, take_home_usd, buyer_price_usd and the fees added on top), with problems listing anything a confirmed call would refuse and ignored_answers any key the category does not ask. Listing is free. The seller is paid their take-home at pickup (bank transfer, Venmo, Cash App, or PayPal), not after delivery. Promote is an optional add-on and this never turns it on. Within minutes of publishing, a description is generated from details and may retitle the listing; it can state things the seller never said, so check it on the listing page (support corrects it; no tool edits one). environment in the result names the deployment: only production reaches real buyers.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • listing_crosslist_draftUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. Save a draft and return a confirm link. Nothing is published until the seller opens the link and taps Publish. No Commonplace account is required. When seller_phone is included, the seller is also texted the link. Use this when also posting to Facebook Marketplace, Craigslist, or OfferUp, and when this connection cannot create listings itself. The price the seller asked for on Facebook Marketplace, Craigslist, or OfferUp becomes their take-home on Commonplace. The buyer price includes pickup and delivery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • pricing_quote_crosslistUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. The price the seller asked for on Facebook Marketplace, Craigslist, or OfferUp becomes their take-home on Commonplace. The buyer price includes pickup and delivery. Give category and price. price_type defaults to take_home. Pass facebook_buyer_price when the number is what a buyer pays on the other site. ZIP is optional. The result is take_home_usd and buyer_price_usd.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • seller_relist_listingPut one of the seller's own inactive listings back on the marketplace.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "put": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Put one of the seller's own inactive listings back on the marketplace. Only an inactive listing can be relisted. Requires confirmed: true.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: false
    • idempotentHint: true
  • support_create_ticketHand a problem to the Commonplace support team.Reads text others writeNo findings

    Why it is in this group

    • The name "support_create_ticket" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hand a problem to the Commonplace support team. A teammate follows up by text or email using the contact details on the account. Use it for things no tool can do: order changes, pickup problems, payout questions, disputes. Requires confirmed: true. Limited to a few per day per account.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 10Claude Code: allow
  • account_get_profileThe Commonplace account this connection acts for: name, and a masked phone and email.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "account_get_profile" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The Commonplace account this connection acts for: name, and a masked phone and email. Use it to confirm the right account before creating or changing anything. phone: null only means the account has no phone on file; each listing made with listing_create carries its own pickup phone (seller_phone), which is how Commonplace reaches the seller about that listing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • catalog_get_listingFull public detail for one listing: buyer_price_usd (what a buyer pays, delivery within 100 miles included), availability, condition, location, dimensions, weight, highlights, the …No findings

    Why it is in this group

    • The name "catalog_get_listing" says "get": a word for reading.
    Description, as the server wrote it
    Full public detail for one listing: buyer_price_usd (what a buyer pays, delivery within 100 miles included), availability, condition, location, dimensions, weight, highlights, the seller's description, photo links, when it was listed, is_yours (whether it belongs to this account), and hsa_fsa_eligible (whether HSA or FSA funds can pay for it). Condition is in the sell form's spelling (New, Like New, Excellent, Very Good, Good, Fair, Poor, Used) when it is one of those grades, otherwise the seller's own words. Categories offer different grades; the ones a new listing can use are its category's condition_options from listing_resolve_category. original_price_usd is the item's retail price new, when known; a price change does not set it. Fields that are not on file come back null.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • catalog_list_categoriesEvery category new listings are filed under, with its slug; departments, slugs that cover every category in them (furniture, fitness); and older_categories, slugs that older live l…No findings

    Why it is in this group

    • The name "catalog_list_categories" says "list": a word for reading.
    Description, as the server wrote it
    Every category new listings are filed under, with its slug; departments, slugs that cover every category in them (furniture, fitness); and older_categories, slugs that older live listings still carry, which search accepts too. Use a slug with listing_resolve_category, the pricing tools or search to avoid guessing. A category's listings can be stored under an older slug (Peloton Bike's under peloton-bike-2nd-gen), which searching the category covers. A department does not cover older_categories: to include them, add their slugs to the search's category list (sofas,living-room-sets).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • catalog_search_listingsSearch live Commonplace inventory by words, category, place (deliver_to alone returns some listings near it, not every one), or any mix.No findings

    Why it is in this group

    • The name "catalog_search_listings" says "search": a word for reading.
    Description, as the server wrote it
    Search live Commonplace inventory by words, category, place (deliver_to alone returns some listings near it, not every one), or any mix. Results are active and buyable. outcome: ok; none; none_within_limits (every match is in hidden); out_of_budget (matches only outside the price range; examples ignore deliver_to); undeliverable (none reaches deliver_to; examples say how far). With deliver_to, each result carries delivery (known, deliverable, driving distance_miles, fee_usd, total_usd). Candidates come from the words or categories plus the catalogue's proximity ranking, not the whole catalogue: to be thorough, also search category_hint and its department. Up to 40 are checked per call, roughly nearest first; with max_distance_miles, one already well past it in a straight line is not checked but counted in too_far (distance_is_straight_line: a lower bound, not a drive). delivery_checked, candidates_considered and candidates_unchecked (could be inside the limits, never checked) say how far it got; next_offset, passed back as offset, checks the rest. cheapest and most_expensive spend all 40 checks and return the best (results_not_shown counts the rest; a limit up to 40 returns them); any sort orders only what was checked. farthest_checked_miles, the longest drive measured, can pass the radius. `hidden` counts every candidate left out, once each, by reason, with its nearest or cheapest examples. When no title matches, the category the words point to is browsed (no_title_matched) or the outcome is none; matched_on names looser words that matched. more_available: candidates_unchecked (see next_offset), or more_matches_unread: more listings match than one search reads, which offset cannot reach; narrow the words, category or price.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • listing_resolve_categoryUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…No findings

    Why it is in this group

    • The name "listing_resolve_category" says "resolve": a word for reading.
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. Work out which Commonplace category an item belongs to and what it needs before it can be listed (terms as in the server instructions). An exact category slug or name is taken as given; other words are matched. Returns required_questions (exact option strings; other_values_accepted means a value not listed may be given as written), condition_options with condition_shown_as (how each reads in the public title, which never reads worse than Fair: Poor reads Fair), seller_costs (the pickup fee and the transaction fee, added on top of the seller's take-home) and buyer_price_addons (delivery within 100 miles, included in the buyer price). Category drives the pickup fee and so the take-home: resolve it before quoting or listing. ambiguous is true when only a brand was named and its models differ in fees (a brand's own parent category, such as peloton, is never a category to list under), or when the item's own words name a different category from the match; possible_categories then lists the choices, each with its costs, and passing the right one back as item settles it. other_candidates lists nearby categories whose names share a word with the item. Condition is not a required question: it is listing_create's own condition argument, and where the options name a usage band (rides, uses) the grade is by usage alone.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • pricing_get_guideUse when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace,…No findings

    Why it is in this group

    • The name "pricing_get_guide" says "get": a word for reading.
    Description, as the server wrote it
    Use when the user is selling a large or valuable item (fitness equipment, hot tubs, saunas, golf carts, furniture, appliances), including when also posting to Facebook Marketplace, Craigslist, or OfferUp. What comparable items sell or list for, as low / typical / high prices before delivery (buyers see these plus added_to_buyer_price_usd, in buyer_prices_usd): low is the 25th percentile, typical the median, high the top of where most sit (never below typical). take_home_usd is what a seller is paid when an item sells at each figure. sample_size counts every listing it is based on, sold and past ones included. model narrows it to listings whose titles name a brand, model or year; narrowed_to says whether it did, and model_matches how many listings name it (a range needs 5). basis says whether the range comes from sold items or listings; a narrowed range can differ in basis from the whole category. available: false means too little data for a range. The price the seller asked for on Facebook Marketplace, Craigslist, or OfferUp becomes their take-home on Commonplace. The buyer price includes pickup and delivery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • seller_list_listingsThe seller's own listings - the same list Your Listings shows - with each one's status (Active; In review; Reserved; Sold; Inactive, which seller_relist_listing can bring back; Rem…Reads text others writeNo findings

    Why it is in this group

    • The name "seller_list_listings" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.
    Description, as the server wrote it
    The seller's own listings - the same list Your Listings shows - with each one's status (Active; In review; Reserved; Sold; Inactive, which seller_relist_listing can bring back; Removed, taken down by the seller, shown only with include_removed and never back), pricing_basis (take_home: seller_update_listing's price_usd sets take_home_usd; asking_price, older listings: it sets asking_usd, null on one lifted to its floor), take_home_usd, buyer_price_usd, the transaction and pickup fees, and link. Removed listings are left out unless include_removed is true. Drafts saved without photos are not listings yet; they are returned separately in drafts_awaiting_photos, each with its finish link. A draft only ever lacks photos: with one, a listing publishes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • seller_list_offersOffers buyers have made on the seller's own listings.No findings

    Why it is in this group

    • The name "seller_list_offers" says "list": a word for reading.
    Description, as the server wrote it
    Offers buyers have made on the seller's own listings. Shows the amount, the listed price at the time, the status and any counter. Amounts are in buyer-price terms, like buyer_price_usd; accepting reprices the listing to the agreed amount and works the seller's take-home out again. Buyers are shown by first name and last initial; their contact details are never available.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • seller_list_salesOrders on the seller's items: order number, status, inspection result, the payout on each and the pickup window.No findings

    Why it is in this group

    • The name "seller_list_sales" says "list": a word for reading.
    Description, as the server wrote it
    Orders on the seller's items: order number, status, inspection result, the payout on each and the pickup window. Commonplace pays sellers at pickup, after inspection, by payment link. This system does not record whether a payout was actually sent, so payout_sent is always null here.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • support_search_helpAnswer a question about how Commonplace works.No findings

    Why it is in this group

    • The name "support_search_help" says "search": a word for reading.
    Description, as the server wrote it
    Answer a question about how Commonplace works. platform_policy states the current rules on the topics the question is about (delivery, payment, inspection and returns, warranty, offers, selling), from the live settings. answers are the closest published help articles, each marked truncated when cut short (the whole answer is at help_center_url). loosely_related shares some words with the question (it can still hold the answer, so read it) and does not count toward found, but can still hold the answer in other words (a subscription, asked about as a membership). found is true when platform_policy or answers has something. Where an article disagrees with platform_policy, platform_policy is current.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:43 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
13
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://trycommonplace.com/.well-known/oauth-protected-resource/mcp
Authorization servers
https://trycommonplace.com
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 13 tools that change things (5 destructive, 1 irreversible, 7 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://trycommonplace.com/mcp: tools/list returned 23 tools to an anonymous client, including mark_sold_elsewhere (destructive), listing_discard_draft (destructive), seller_update_listing (destructive), seller_remove_listing (destructive), seller_respond_offer (destructive) and 8 more

    What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http seller https://trycommonplace.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__seller__catalog_search_listings",
      "mcp__seller__catalog_get_listing",
      "mcp__seller__catalog_list_categories",
      "mcp__seller__listing_resolve_category",
      "mcp__seller__pricing_get_guide",
      "mcp__seller__support_search_help",
      "mcp__seller__account_get_profile",
      "mcp__seller__seller_list_listings",
      "mcp__seller__seller_list_offers",
      "mcp__seller__seller_list_sales"
    ],
    "ask": [
      "mcp__seller__pricing_quote_payout",
      "mcp__seller__delivery_quote_listing",
      "mcp__seller__listing_crosslist_draft",
      "mcp__seller__pricing_quote_crosslist",
      "mcp__seller__listing_create",
      "mcp__seller__listing_add_photos",
      "mcp__seller__seller_relist_listing",
      "mcp__seller__support_create_ticket"
    ],
    "deny": [
      "mcp__seller__mark_sold_elsewhere",
      "mcp__seller__listing_discard_draft",
      "mcp__seller__seller_update_listing",
      "mcp__seller__seller_remove_listing",
      "mcp__seller__seller_respond_offer"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as seller. Review it before you use it.

Capability tags behind 10 rules
  • mcp__seller__listing_crosslist_draft untrusted-input
  • mcp__seller__account_get_profile private-data, untrusted-input
  • mcp__seller__seller_list_listings untrusted-input
  • mcp__seller__listing_create untrusted-input
  • mcp__seller__listing_add_photos untrusted-input
  • mcp__seller__seller_update_listing untrusted-input
  • mcp__seller__seller_relist_listing untrusted-input
  • mcp__seller__seller_remove_listing untrusted-input
  • mcp__seller__seller_respond_offer untrusted-input
  • mcp__seller__support_create_ticket untrusted-input